Ahh. Well character encoding is the easy part. It’s the ANSI escape parsing that’s problematic. You can think of it like HTML (in the sense that it’s inlined markup with the content) but with much weirder syntax, a tonne of edge cases, and even less consistency with comparability between client.
I honestly hate escape sequences. I even experimented with building entirely new control plains for the term I’d written. But then who’s going to use it if you don’t also support escape sequences. And so you’re back to original problem again.
The one good thing about these escape sequences was that they only controlled the display. Almost everything that controlled the window behaviour (bar the window title) had dropped out of favour. But things like OSC8 reintroduce behavioural changes that can surprise unexpected users and opens the terminal to whole new forms of abuse by misbehaving input.
If you think back to the HTML analogy; how many times have we seen exploits abuse mouse click events? And these browsers have several orders of magnitude more funding in development and security testing. So what hope do we have that hobby project terminals will even come close to the same level of security despite being used to manage arguably more sensitive systems?
I honestly hate escape sequences. I even experimented with building entirely new control plains for the term I’d written. But then who’s going to use it if you don’t also support escape sequences. And so you’re back to original problem again.
The one good thing about these escape sequences was that they only controlled the display. Almost everything that controlled the window behaviour (bar the window title) had dropped out of favour. But things like OSC8 reintroduce behavioural changes that can surprise unexpected users and opens the terminal to whole new forms of abuse by misbehaving input.
If you think back to the HTML analogy; how many times have we seen exploits abuse mouse click events? And these browsers have several orders of magnitude more funding in development and security testing. So what hope do we have that hobby project terminals will even come close to the same level of security despite being used to manage arguably more sensitive systems?